SitioPH privacy notice

Effective [the date the website launches]

SitioPH is a system for passes at the gates of Philippine gated communities: residents tell the gate who is coming, guards check them in, and each community's board runs it. This notice explains what SitioPH keeps about you, who sees it, how long it is kept, and what you can do about it, under the Data Privacy Act of 2012 (RA 10173).

Who we are

SitioPH is operated by NBM Solutions, Dasmariñas, Cavite, Philippines. Our data protection officer is Maricar Rempojo, reachable at privacy@nbm-solutions.ph.

Who is responsible for your data

SitioPH is responsible for your account: your name, your email address, and the record of your sign-ins. One account can belong to several communities.

Your community's homeowners' association is responsible for your community's records: its homes and who lives in them, its passes and the visitors named on them, the entries and exits at its gates, and its contact details. SitioPH keeps and processes those records for your association.

What we keep

• If you have an account: your name, your email address, the communities and roles you hold, the date you acknowledged this notice, and a record of your sign-ins and of changes made to your account and roles.
• If you are a resident: the homes you live in, whether you represent a home or are part of its household, and the passes you issue.
• If you are named on a pass (a visitor, a delivery rider or a contractor): what the resident wrote: your name or company, your vehicle's plate, a note for the guard, and for a contractor the work to be done. If the board declines a contractor request or anyone cancels a pass, the reason they give is kept with it.
• When you enter or leave through a gate: which gate, when, and which guard recorded your entry or exit.
• For a community: its contact email and phone, which may be a board member's.
• If you send us an enquiry from our website: your name, email address, community and role, and the mobile number, number of homes and message you choose to give.
• If you accept analytics on our website: how you use the website, such as the pages you open and the site you came from, linked by a cookie on your device.

Why we keep it

To let only the people a resident expects through the gate; to let guards check a pass quickly; to let a community's board see who came in and who left, and run the community; to let you sign in; to keep a record of who did what, so changes can be checked later; to answer your enquiry about SitioPH; and, if you accept analytics, to learn how our website is used.

Who sees it

• Your name is seen by the people you deal with on SitioPH.
• A pass, with its entries and exits, is seen by the resident who issued it, by the community's board, and by its guards on the day it can be used or when its code is shown to them. A contractor request is seen by the board until it is decided.
• While a guard is signed in at the gate, the gate device keeps that day's passes so the guard can check them without a connection. They are removed when the guard signs out, when the sign-in ends, and at midnight.
• Who lives in which home is seen by your community's board, by SitioPH's operators, and by you.
• A community's contact details are seen by its members and by SitioPH's operators, never by the public.
• A board member may download the list of homes or of people for the board's own use. They are warned that it holds names, emails and addresses, and every download is recorded.
• SitioPH's operators see the communities they run, their boards and the figures of their passes, not the visitors' details.
• An enquiry you send from our website is seen only by SitioPH's team.

Services that hold your data

We use a sign-in provider, Auth0, to hold your name, email address and password. It keeps them in Japan, outside the Philippines, with the safeguards RA 10173 requires. SitioPH's records are kept with Amazon Web Services in Singapore, also outside the Philippines with the same safeguards, and your invitations and password resets are sent from there by Amazon SES, an email delivery service.

Our website runs on Cloudflare, whose network spans the world: it checks that an enquiry is sent by a person with Cloudflare Turnstile, and your enquiry reaches us through Cloudflare's email service. If you press Accept on its cookie banner, it counts your visits with Google Analytics, which keeps its data in the United States. Nothing is tracked unless you accept, and you can change your choice at any time with Cookie settings at the foot of any page.

How long we keep it

• If your account is deactivated, your name and email address are erased 12 months later.
• Visitors' details on a pass, the work described and any decline or cancel reason are erased 12 months after the pass's last day. The pass and its entries and exits stay as a record without them.
• Who lives in which home is removed when you stop being a member of the community, or when the community is deleted.
• A community's contact details are removed when the community is deleted.
• The records of who did what (sign-ins, invitations, role changes, pass decisions and cancellations, entries and exits, downloads) are kept for 12 months.
• An enquiry is deleted 12 months after our last email with you.
• Your choice on our cookie banner is remembered on your device for 12 months, and analytics data about your visits is kept for 2 months.

Your rights

Under RA 10173 you have the right to be informed, to access your data, to object to its use, to have it erased or blocked, to have it corrected, to receive it in a form you can take elsewhere, to be compensated for damage, and to file a complaint with the National Privacy Commission.

How to ask

Email privacy@nbm-solutions.ph. Tell us who you are and what you are asking for. We answer for your account; for your community's records we pass your request to your community's board, which is responsible for them. You do not need an account to ask.

Your acknowledgement

When you create an account, we ask you to confirm that you have read this notice, and we record the date you did.

Changes to this notice

If this notice changes, the new version shows its new effective date here. We keep every earlier version, so we can show you the one you read when you created your account.